| Summary: | <dev-db/postgresql-{9.2.21,9.3.17,9.4.12,9.5.7}: multiple vulnerabilities (CVE-2017-{7484,7485,7486}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | pgsql-bugs, sudormrfhalt |
| Priority: | Normal | Keywords: | STABLEREQ |
| Version: | unspecified | Flags: | stable-bot:
sanity-check+
|
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.postgresql.org/about/news/1746/ | ||
| Whiteboard: | B3 [glsa glsa cve] | ||
| Package list: |
=app-eselect/eselect-postgresql-2.1
=dev-db/postgresql-9.2.21
=dev-db/postgresql-9.3.17
=dev-db/postgresql-9.4.12
=dev-db/postgresql-9.5.7
|
Runtime testing required: | No |
| Bug Depends on: | 627462 | ||
| Bug Blocks: | |||
Here are the stabilization targets: =app-eselect/eselect-postgresql-2.1 ~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 =dev-db/postgresql-9.2.21 ~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 =dev-db/postgresql-9.3.17 ~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 =dev-db/postgresql-9.4.12 ~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 =dev-db/postgresql-9.5.7 ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 While app-eselect/eselect-postgresql-2.1 was just added today, it was to fix the only bug open against 2.0 (which is the minimum these ebuilds require) since it was introduced a over a month ago. As has been mentioned on previous bugs, 9.5 on up is excluded from Alpha stabilization given upstream dropping support specific to that architecture. amd64 stable x86 stable ppc ppc64 stable. sparc stable Stable on alpha. Stable on alpha. arm stable CVE-2017-7486 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7486): PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server. CVE-2017-7485 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7485): In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing a SSL/TLS connection to a PostgreSQL server. An active Man-in-the-Middle attacker could use this flaw to strip the SSL/TLS protection from a connection between a client and a server. CVE-2017-7484 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7484): It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, possibly leaking information. An unprivileged attacker could use this flaw to steal some information from tables they are otherwise not allowed to access. ia64 stable @hppa ping Stabilization work now to be done on bug 627462. GLSA Vote: Yes Added to an existing GLSA Request. This issue was resolved and addressed in GLSA 201710-06 at https://security.gentoo.org/glsa/201710-06 by GLSA coordinator Aaron Bauman (b-man). |
From ${URL} : Three security vulnerabilities have been closed by this release: CVE-2017-7484: selectivity estimators bypass SELECT privilege checks CVE-2017-7485: libpq ignores PGREQUIRESSL environment variable CVE-2017-7486: pg_user_mappings view discloses foreign server passwords The fix for CVE-2017-7486 applies to new databases, see the release notes for the procedure to apply the fix to an existing database. Any user relying on the PGREQUIRESSL environment variable is encouraged to use the sslmode connection string option, as use of PGREQUIRESSL is deprecated. CVE-2017-7485 does not affect the 9.2 series. For more information on these issues and how they affect backwards-compatibility, see the Release Notes. @maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.